When Image Guardian is enabled on a partition, it is designed to block any non-Macrium application from modifying or deleting any Reflect backup files on that partition. It doesn't try to decide whether it's malware. If it's not a Macrium application, it gets blocked. That includes you trying to rename or delete a file yourself through Windows Explorer. But by the same token, Image Guardian makes no effort to protect your entire system from viruses. It focuses ONLY on preventing anything from modifying Reflect backup files. The idea is that if your system gets trashed by malware or your data gets encrypted by ransomware, you'll still have intact backups to restore from. Full information in the KB article about Image Guardian here.

One note in addition to the above: One limitation of Image Guardian is that if a piece of malware (or a person) tries to format the partition that contains your backups, Image Guardian will not block that, so in that situation you would lose your backups on that partition, along with all of the other data on that partition. But the main focus is protecting against ransomware, because malicious actors would rather encrypt your data and then try to get you to pay ransom rather than just destroying your data. They don't make any money by destroying your data, but if they can lock you out of your data, then you might pay them to get it back. Image Guardian is designed to keep your backups safe from that situation.

Having your backups physically offline is an even better solution for people who can do that in a practical way.

Well, I have an external HD. I do an imaging,...Then shut down the External HD! I ran into a problem late year...but OK now. My Boot master was deleted...could not figure out the fix...since no mouse or keyboard would respond. SOLUTION: place mouse into a different port. Thanks